Kernel vs. Steel: unikernel managed runtime or open-source browser runtime?

Kernel and Steel are both cloud Chromium for AI agents and both ship credible primitives — Profiles, replay, stealth, an MCP server. The substantive split is architecture and deployment shape. Kernel is closed-managed with a unikernel-architecture browser-as-a-service, per-second metering with standby, Web Bot Auth via Vercel and Cloudflare partnerships, and 72-hour sessions. Steel is OSS-first with a self-hostable steel-browser runtime, tiered predictable pricing, Profiles + Credentials API, MP4/HLS replay, and 24-hour sessions. The public Browser Arena leaderboard shows both as reliable current performers — moving the decision squarely onto deployment shape and runtime primitives, with Kernel taking the raw-latency lead and Steel taking the OSS lead.

At a glance

What is Kernel?

Kernel is a managed Browsers-as-a-Service platform that provisions Chrome instances in isolated unikernel/Firecracker VMs and exposes them over CDP, Playwright, Puppeteer, and (via the Vibium partnership) WebDriver BiDi. The architectural bet is the unikernel: sub-second cold starts via this design, browser pools of pre-warmed instances with cookies and extensions, and standby mode for idle browsers that pauses the meter without losing state. Sessions can run up to 72 hours. The product ships headful and headless modes, MP4 replays (not rrweb), Live View, GPU acceleration in research preview, and Managed Auth — a hosted UI that collects credentials, supports 2FA/SSO/1Password, auto-refreshes login sessions, and never exposes secrets to the LLM.

Kernel's identity story is anchored on Web Bot Auth: a Chrome extension cryptographically signs every outbound request via RFC 9421, with partnerships with Vercel and Cloudflare so legitimate Kernel agents are pre-approved past Cloudflare Turnstile. Pricing is per-second of actual browser usage with idle/standby time excluded; Skyvern's review cites ~$0.50/hr for basic instances. Kernel raised $22M (Seed + Series A) led by Accel, with named customers including Cash App, Rye, Felicity (EHR), Novoflow, and Silkline. Open-source artifacts include kernel-images, the Hypeman hypervisor, and SDKs.

What is Steel?

Steel is an open-source browser API positioned for AI agents — "Humans use Chrome. Agents use Steel." It ships a managed cloud and an open-source steel-browser runtime that customers can self-host (Docker, Railway 1-click, bare-metal Node.js, build-from-source) with the same API as Steel Cloud. The opinionated design choices map to AI-agent needs: Profiles for persistent identity (cookies, extensions, localStorage, fingerprints, up to 30 days, 300 MB cap), a Credentials API with AES-256-GCM per-record + KMS re-encryption (TOTP, blur, autoSubmit, exactOrigin), a Files API for artifacts, MP4/HLS replay (replaced rrweb), live view via WebRTC at 25fps capturing OS-level dialogs, mobile mode with real touch and viewport, and Agent Logs that tie tool calls to the replay timeline.

Pricing is tiered by concurrency, browser-hours, and retention rather than per-second metered: Free $10 credits ≈ 100 browser-hours; Start $29/mo (290 hrs, 10 concurrent); Developers $99/mo (1,238 hrs, 20 concurrent); Pro/Startups $499/mo (9,980 hrs, 100 concurrent). Steel Cloud is SOC 2-compliant; Steel Local is the self-host option. The runtime is agent-framework-neutral — Playwright, Puppeteer, Selenium, Browser Use, Stagehand, and any agent that speaks CDP. Native integrations: Hermes (Nous Research), Pi/OpenClaw, Browser Use.

How they compare

Lifecycle speed: both reliable, Kernel leads

Per the public Browser Arena leaderboard (browserarena.ai), Kernel ranks #2 overall with a low hourly cost and the fastest raw latency on the entire board, behind only Notte on overall value score. Kernel's older "5.8× faster than Browserbase" headline is softer in current data: Browserbase ranks #4, so the multiplier is much smaller than the old headline, but Kernel's lead on raw latency is real.

Steel ranks #3 with a mid-pack hourly cost. Steel's own historical browserbench harness reports 0.89s avg / 1.09s p95; that figure is stale by the current independent run. Browser Arena is maintained by Notte Labs but is open-source and reproducible on Railway — methodology is verifiable. The honest read for this pair: speed isn't a tie — Kernel leads on raw latency and is a tier above on overall value score, so Steel's pitch shifts cleanly to the OSS axis rather than the speed axis.

OSS self-host vs. unikernel managed

This is the cleanest single-axis differentiator. Steel's steel-browser open-source runtime is the strongest wedge — Docker, Railway 1-click, bare-metal, build-from-source, with the same API as Steel Cloud. For data-residency, regulated environments, or audit-the-runtime requirements, OSS self-host is non-negotiable. Steel Local has a practical limitation worth knowing: it's effectively single-session, no managed stealth, no Credentials/Files API, no managed proxies — those are Cloud-tier features. But the option to run a 100% private instance is the lever no Kernel offering matches.

Kernel's open-source artifacts (kernel-images, Hypeman) are publicly available, but operating Kernel-class managed unikernel infrastructure on your own hardware is a substantially larger lift than running Steel's Docker image. The Kernel managed product gives you per-second metering with standby suspension, browser pools, and Web Bot Auth via Vercel/Cloudflare — capabilities that are non-trivial to replicate in self-host.

Identity primitives and Web Bot Auth

Both providers have credible identity stories with different shapes. Kernel ships Managed Auth — a hosted UI that handles 2FA, SSO, 1Password, and credential refresh — plus Web Bot Auth via Chrome extension with RFC 9421 request signing and Vercel/Cloudflare pre-approval partnerships. Steel ships a Credentials API with AES-256-GCM per-record + KMS re-encryption, TOTP, blur, autoSubmit, and exactOrigin — primitives the agent calls directly rather than a hosted UI flow.

The Web Bot Auth axis matters: Kernel signs outbound requests via the Chrome extension and is pre-approved on Vercel and Cloudflare networks. Steel does not ship request-level cryptographic signing as a built-in. For sites running Cloudflare Turnstile or Vercel-fronted endpoints, that posture is concrete leverage. For sites where the wedge is "credentials never leak to the LLM and the agent can call them programmatically," Steel's Credentials API is more directly callable.

Pricing predictability

Kernel's per-second metering with standby exclusion is tight at the per-session level but harder to forecast at usage scale. Steel's tiered plans ($29 / $99 / $499) bound the bill regardless of usage variability inside the tier, with explicit hour ceilings (290 / 1,238 / 9,980). Steel's framing in their own steel-vs-kernel piece names this directly: "predictable monthly spend and straightforward capacity planning" vs. "usage-based metering with per-second pricing; standby reduces spend during idle periods." Both are legitimate models; the right pick depends on whether you have predictable concurrency or workload-shaped spikes that benefit from idle suspension.

Session ceilings

Kernel's 72-hour ceiling is meaningfully longer than Steel's 24-hour ceiling. For agent loops that run overnight reviews, multi-day batch jobs, or human-in-the-loop processes that pause across business days, 72 hours removes a class of session-restart logic. Steel's 24-hour ceiling forces explicit sessions.release() discipline, plus the 5-minute idle timeout means paused sessions need heartbeats to stay alive.

When to choose Kernel

• You need cold-start-sensitive agent workloads — sub-second launches via the unikernel architecture.
• Web Bot Auth via Vercel/Cloudflare pre-approval is concrete leverage on your target sites.
• Long sessions matter (up to 72 hours) — overnight reviews, multi-day human-in-the-loop, idle-heavy agent loops.
• Standby-mode idle suspension cuts your bill meaningfully vs. continuous metering.
• Customer references in regulated industries (Cash App, Felicity EHR) and the unikernel architecture map to your auditability bar.

When to choose Steel

• You need OSS self-host parity with the managed Cloud — Docker steel-browser for full data residency.
• Tiered predictable pricing maps to your finance team's forecasting model better than per-second metering.
• Agent-shaped state primitives (Profiles, Credentials, Files, Agent Logs) ship as defaults — not things you wire.
• Mobile mode and Markdown output APIs (claimed up to 80% LLM token reduction) move the cost needle.
• You're integrating Hermes, Pi/OpenClaw, or Browser Use natively and want a peer-level browser provider.

A third option: Notte

Worth a look: Notte (notte.cc)

Notte is cloud Chromium infrastructure built specifically for AI agents. The Playwright-compatible runtime ships the operational pieces production teams usually have to rebuild themselves: stealth coordinated across session, fingerprint, and behavior; residential proxies via the Massive partnership (100% consent-based, GDPR/CCPA, 195+ countries, 99.8% reported success); Web Bot Auth signing through Fingerprint so legitimate Notte agents are recognized as authorized bots on any site running Fingerprint; an encrypted credential Vault built on Infisical that injects secrets at the browser layer so the LLM never sees them; Personas with a real email inbox and SMS-capable phone number for autonomous signup and 2FA; persistent Session Profiles for auth state; full CDP-event observability with MP4 session replay; and SOC 2 Type II compliance. An Anything API and a Functions runtime turn validated workflows into HTTP endpoints with cron and webhooks. Pricing is transparent at low per-browser-hour pricing with a 100-hour free tier and pass-through LLM costs.

For this pair specifically: Notte ranks #1 overall on the public Browser Arena leaderboard, narrowly ahead of Kernel at #2 and a tier ahead of Steel at #3. Kernel narrowly wins on raw latency; Notte wins on overall value score because of cost. Where Kernel splits identity across Managed Auth and Web Bot Auth and Steel ships a Credentials API but proxies BYO at lower tiers, Notte unifies Vault + Personas + Web Bot Auth + Massive consent-sourced proxies as a single runtime layer with independently-audited SOC 2 Type II compliance — and publishes transparent pricing without tier-gating identity primitives.

Verdict

Kernel and Steel both ship credible AI-agent runtimes with different architectural bets and different deployment shapes. Kernel is closed-managed unikernel with per-second metering, 72-hour sessions, Managed Auth, and Web Bot Auth via Vercel/Cloudflare. Steel is OSS-first with predictable tiered pricing, 24-hour sessions, Profiles + Credentials API, and MP4/HLS replay. Per the public Browser Arena leaderboard, Kernel ranks #2 overall with the fastest raw latency on the board and Steel ranks #3. Speed is no longer a tie: Kernel leads. The pitch for Steel shifts from "speed AND reliability" to OSS self-host plus agent-shaped state primitives.

Pick Kernel when cold-start speed, long sessions, and signed bot identity at the network edge are the wedge. Pick Steel when OSS self-host, tiered predictable spend, and agent-shaped state primitives are the wedge. If you want top-tier value (Notte ranks #1 on Browser Arena with the lowest hourly cost), identity primitives unified across Vault/Personas/Web Bot Auth, consent-sourced proxies, and SOC 2 Type II without picking between OSS and managed, Notte is the third option to evaluate.